CVE-2022-22738

What it actually does

CSS filter effects trigger out-of-bounds memory reads leading to heap-buffer-overflow and a potentially exploitable crash in the rendering engine.

Why it matters to the business

Unpatched browsers and email clients remain exposed to remote code execution or denial-of-service attacks delivered through ordinary web content or email, increasing risk of data theft, malware deployment, and operational disruption; the flaw has been public for nearly four years with working exploits available.

How an attack unfolds

An attacker crafts a web page or HTML email containing a specially formed CSS filter, tricks the victim into rendering it in an affected Firefox or Thunderbird instance, triggers the out-of-bounds access, and leverages the resulting heap corruption to execute arbitrary code.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Remove or isolate older installations until updates are applied.

How to confirm the fix worked

Verify installed product versions against the fixed releases (Firefox >=96, ESR/Thunderbird >=91.5); re-test rendering of known trigger CSS filters in updated builds to confirm absence of the crash condition.

Typical attack path

1. Attacker prepares malicious HTML/CSS payload targeting the filter code path
2. Victim is enticed to open the content via browser or email client
3. Rendering engine applies the filter and performs out-of-bounds read/write
4. Heap corruption is turned into code execution or crash
5. Attacker establishes persistence or exfiltrates data

How to detect it

Review browser and email client crash reports for heap-related faults triggered during CSS rendering; inspect web proxy and email logs for repeated delivery of content containing complex filter styles from untrusted sources; correlate with endpoint process crashes matching the affected products.

What your security team should do

• Immediately inventory all Firefox, ESR, and Thunderbird deployments and prioritize patching to the versions listed above
• Enable automatic updates where possible and enforce update policies via enterprise management tools
• Block or sandbox untrusted web and email content until patches are deployed
• Monitor vulnerability disclosure feeds for any new exploit campaigns targeting this issue